Harden API endpoints: input validation, error sanitization, security headers

- Add shared validation helper (server/lib/validation.js) with ID regex, provider/type allowlists
- Validate all route params against allowlists before filesystem operations to prevent path traversal
- Strip stack traces and error.message from production error responses (generic "Internal server error")
- Sanitize filenames in Content-Disposition headers
- Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to dev server static responses
- Add path traversal (.. ) checks to all static file handlers and catch-all fetch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/command-source/[id].js

@@ -6,9 +6,16 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const PROJECT_ROOT = join(__dirname, "../..");
 
+const VALID_ID = /^[a-zA-Z0-9_-]+$/;
+
 export default function handler(req, res) {
   try {
     const { id } = req.query;
+
+    if (!id || !VALID_ID.test(id)) {
+      return res.status(400).json({ error: "Invalid command ID" });
+    }
+
     const commandPath = join(PROJECT_ROOT, "source", "skills", id, "SKILL.md");
 
     if (!existsSync(commandPath)) {
@@ -19,6 +26,6 @@ export default function handler(req, res) {
     res.status(200).json({ content });
   } catch (error) {
     console.error("Error in /api/command-source:", error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 }

api/commands.js

@@ -42,7 +42,7 @@ export default function handler(req, res) {
     res.status(200).json(commands);
   } catch (error) {
     console.error("Error in /api/commands:", error);
-    res.status(500).json({ error: error.message, stack: error.stack });
+    res.status(500).json({ error: "Internal server error" });
   }
 }
 

api/download/[type]/[provider]/[id].js

@@ -33,6 +33,9 @@ function getFilePath(type, provider, id) {
   return null;
 }
 
+const VALID_ID = /^[a-zA-Z0-9_-]+$/;
+const ALLOWED_PROVIDERS = ['cursor', 'claude-code', 'gemini', 'codex', 'agents', 'universal'];
+
 export default function handler(req, res) {
   try {
     const { type, provider, id } = req.query;
@@ -41,6 +44,14 @@ export default function handler(req, res) {
       return res.status(400).json({ error: "Invalid type" });
     }
 
+    if (!provider || !ALLOWED_PROVIDERS.includes(provider)) {
+      return res.status(400).json({ error: "Invalid provider" });
+    }
+
+    if (!id || !VALID_ID.test(id)) {
+      return res.status(400).json({ error: "Invalid file ID" });
+    }
+
     const filePath = getFilePath(type, provider, id);
 
     if (!filePath) {
@@ -52,13 +63,13 @@ export default function handler(req, res) {
     }
 
     const content = readFileSync(filePath);
-    const fileName = basename(filePath);
+    const fileName = basename(filePath).replace(/[^a-zA-Z0-9._-]/g, '');
     res.setHeader("Content-Type", "application/octet-stream");
     res.setHeader("Content-Disposition", `attachment; filename="${fileName}"`);
     res.send(content);
   } catch (error) {
     console.error("Error downloading file:", error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 }
 

api/download/bundle/[provider].js

@@ -6,9 +6,16 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const PROJECT_ROOT = join(__dirname, "../../..");
 
+const ALLOWED_PROVIDERS = ['cursor', 'claude-code', 'gemini', 'codex', 'agents', 'universal'];
+
 export default function handler(req, res) {
   try {
     const { provider } = req.query;
+
+    if (!provider || !ALLOWED_PROVIDERS.includes(provider)) {
+      return res.status(400).json({ error: "Invalid provider" });
+    }
+
     const distDir = join(PROJECT_ROOT, "dist");
     const zipPath = join(distDir, `${provider}.zip`);
 
@@ -18,11 +25,12 @@ export default function handler(req, res) {
 
     const content = readFileSync(zipPath);
     res.setHeader("Content-Type", "application/zip");
-    res.setHeader("Content-Disposition", `attachment; filename="impeccable-style-${provider}.zip"`);
+    const safeProvider = provider.replace(/[^a-zA-Z0-9._-]/g, '');
+    res.setHeader("Content-Disposition", `attachment; filename="impeccable-style-${safeProvider}.zip"`);
     res.send(content);
   } catch (error) {
     console.error("Error downloading bundle:", error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 }
 

api/patterns.js

@@ -13,6 +13,6 @@ export default function handler(req, res) {
     res.status(200).json({ patterns, antipatterns });
   } catch (error) {
     console.error("Error in /api/patterns:", error);
-    res.status(500).json({ error: error.message, stack: error.stack });
+    res.status(500).json({ error: "Internal server error" });
   }
 }

api/skills.js

@@ -39,6 +39,6 @@ export default function handler(req, res) {
     res.status(200).json(skills);
   } catch (error) {
     console.error("Error in /api/skills:", error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 }